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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 

1. (Currently Amended) A method for detecting a substring of interest from a 
plurality of substrings that arrives out-of-order, comprising: 

receiving a substring with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to content of said 
substring to determine whether said substring matches one of said substrings of 
interest. 

2. (Original) The method of claim 1, wherein if said preceding span and said 
succeeding span do not exist, then said substring is inserted into said span set. 

3. (Original) The method of claim 1, wherein if said succeeding span does exist, 
then said substring is joined with said succeeding span to produce a join span. 

4. (Original) The method of claim 3, wherein said succeeding span is replaced by 
said join span. 

5. (Original) The method of claim 1 , wherein if said preceding span does exist, then 
said preceding span is joined with said substring to produce a join span. 

6. (Original) The method of claim 5, wherein said preceding span is replaced by 
said join span. 
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7. (Original) The method of claim 1, wherein if said preceding span and said 
succeeding span do exist, then said preceding span is joined with said substring to 
produce a join span. 

8. (Original) The method of claim 7, wherein said join span is joined with said 
succeeding span to produce a second join span. 

9. (Original) The method of claim 8, wherein said preceding span and said 
succeeding span are replaced by said second join span. 

10. (Original) The method of claim 1, wherein said substring is forwarded, while 
parameters of said substring are stored. 

11. (Original) The method of claim 10, wherein said parameters comprise at least 
one of a state of said automaton, said index, a length of the substring and a prefix. 

12. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a network monitoring function. 

13. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an intrusion detection function. 

14. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a firewall function. 

15. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a routing function. 

16. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a load balancing function. 
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17. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an anti-virus filtering function. 

18. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as an anti-spam filtering function. 

19. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a document control function. 

20. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a web content filtering function. 

21 . (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a virtual private network monitoring function. 

22. (Original) The method of claim 1, wherein said method for detecting a substring 
of interest is performed as a storage area network security function. 

23. (Original) The method of claim 10, further comprising: 

determining whether said forwarded substring is subsequently dropped by a 
target machine. 

24. (Original) The method of claim 23, wherein if said forwarded substring is 
subsequently dropped, then a connection for passing said forwarded substring is reset. 

25. (Original) The method of claim 24, wherein said connection is a TCP connection. 

26. (Currently Amended) An apparatus for detecting a substring of interest from a 
plurality of substrings that arrives out-of-order, comprising: 
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means for receiving a substring with an index; 

means for determining whether a preceding span exists in a span set; 

means for determining whether a succeeding span exists in said span set; and 

means for applying an automaton having a list of substrings of interest to content 
of said substring to determine whether said substring matches one of said substrings of 
interest. 

27. (Original) The apparatus of claim 26, wherein if said preceding span and said 
succeeding span do not exist, then said substring is inserted into said span set. 

28. (Original) The apparatus of claim 26, wherein if said succeeding span does 
exist, then said substring is joined with said succeeding span to produce a join span. 

29. (Original) The apparatus of claim 28, wherein said succeeding span is replaced 
by said join span. 

30. (Original) The apparatus of claim 26, wherein if said preceding span does exist, 
then said preceding span is joined with said substring to produce a join span. 

31. (Original) The apparatus of claim 30, wherein said preceding span is replaced by 
said join span. 

32. (Original) The apparatus of claim 26, wherein if said preceding span and said 
succeeding span do exist, then said preceding span is joined with said substring to 
produce a join span. 

33. (Original) The apparatus of claim 32, wherein said join span is joined with said 
succeeding span to produce a second join span. 

34. (Original) The apparatus of claim 33, wherein said preceding span and said 
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succeeding span are replaced by said second join span. 

35. (Original) The apparatus of claim 26, wherein said substring is forwarded, while 
parameters of said substring are stored. 

36. (Original) The apparatus of claim 35, wherein said parameters comprise at least 
one of a state of said automaton, said index, a length of the substring and a prefix. 

37. (Original) The apparatus of claim 26, wherein said apparatus is a network 
monitor. 

38. (Original) The apparatus of claim 26, wherein said apparatus an intrusion 
detector. 

39. (Original) The apparatus of claim 26, wherein said apparatus is a firewall. 

40. (Original) The apparatus of claim 26, wherein said apparatus is a router. 

41 . (Original) The apparatus of claim 26, wherein said apparatus is a load balancer. 

42. (Original) The apparatus of claim 26, wherein said apparatus is an anti-virus 
filter. 

43. (Original) The apparatus of claim 26, wherein said apparatus is an anti-spam 
filter. 

44. (Original) The apparatus of claim 26, wherein said apparatus is a document 
controller. 

45. (Original) The apparatus of claim 26, wherein said apparatus is a web content 
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filter. 

46. (Original) The apparatus of claim 26, wherein said apparatus is a virtual private 
network monitor. 

47. (Original) The apparatus of claim 26, wherein said apparatus is a storage area 
network security device. 

48. (Original) The apparatus of claim 35, further comprising: 

means for determining whether said forwarded substring is subsequently 
dropped by a target machine. 

49. (Original) The apparatus of claim 48, wherein if said forwarded substring is 
subsequently dropped, then a connection for passing said forwarded substring is reset. 

50. (Original) The apparatus of claim 49, wherein said connection is a TCP 
connection. 

51. (Currently Amended) A computer-readable medium having stored thereon a 
plurality of instructions, the plurality of instructions including instructions which, when 
executed by a processor, cause the processor to perform the steps of a method for 
detecting a substring of interest from a plurality of substrings that arrives out-of-order, 
comprising of: 

receiving a substring with an index; 

determining whether a preceding span exists in a span set; 

determining whether a succeeding span exists in said span set; and 

applying an automaton having a list of substrings of interest to content of said 
substring to determine whether said substring matches one of said substrings of 
interest. 
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52. (Original) The computer-readable medium of claim 51, wherein if said preceding 
span and said succeeding span do not exist, then said substring is inserted into said 
span set. 

53. (Original) The computer-readable medium of claim 51, wherein if said 
succeeding span does exist, then said substring is joined with said succeeding span to 
produce a join span. 

54. (Original) The computer-readable medium of claim 53, wherein said succeeding 
span is replaced by said join span. 

55. (Original) The computer-readable medium of claim 51, wherein if said preceding 
span does exist, then said preceding span is joined with said substring to produce a join 
span. 

56. (Original) The computer-readable medium of claim 55, wherein said preceding 
span is replaced by said join span. 

57. (Original) The computer-readable medium of claim 51 , wherein if said preceding 
span and said succeeding span do exist, then said preceding span is joined with said 
substring to produce a join span. 

58. (Original) The computer-readable medium of claim 57, wherein said join span is 
joined with said succeeding span to produce a second join span. 

59. (Original) The computer-readable medium of claim 58, wherein said preceding 
span and said succeeding span are replaced by said second join span. 

60. (Original) The computer-readable medium of claim 51, wherein said substring is 
forwarded, while parameters of said substring are stored. 
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61. (Original) The computer-readable medium of claim 50, wherein said parameters 
comprise at least one of a state of said automaton, said index, a length of the substring 
and a prefix. 

62. (Original) The computer-readable medium of claim 50, further comprising: 
determining whether said forwarded substring is subsequently dropped by a 

target machine. 

63. (Original) The computer-readable medium of claim 62, wherein if said forwarded 
substring is subsequently dropped, then a connection for passing said forwarded 
substring is reset. 

64. (Original) The computer-readable medium of claim 63, wherein said connection 
is a TCP connection. 
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